Hack the Route Start free Open app Detection and response
Incident response phases
The ordered runbook for handling a compromise: prepare, identify, contain, eradicate, recover, learn.
Incident response follows set phases so nothing is skipped under pressure. Preparation builds the baseline and runbook; identification confirms and scopes the incident with evidence; containment cuts the attacker's channel while preserving the evidence; eradication removes the implant and its persistence; recovery restores service and proves it is clean; lessons learned records indicators and feeds them back into detection. The order matters: contain before you clean, and do not destroy evidence while stopping the bleeding.